Introduction

When performing security-related tasks in DeepSeek Harness (dsh), the common practice is to open a separate terminal to run penetration testing or code audit CLIs, then copy the output back into the session for further analysis. Because the tool capabilities are not registered as dsh tools, the model cannot invoke them directly, and the results cannot be fed into subsequent automated workflows.

The dsh-vulnsec-bridge plugin is designed to bridge this scenario: it wraps VulnClaw (AI penetration testing CLI) and DeepSec (Shield code audit + Spear authorized penetration) into dsh plugins, providing 18 security tools and a graphical “Security Workbench” panel. Below is an introduction to its features, installation methods, and typical usage.

First, a prerequisite: the plugin’s penetration features are strictly limited to authorized targets and can only act on systems you own or have obtained written authorization for. Please comply with local laws and the target’s authorization terms.

What is this

dsh-vulnsec-bridge is maintained by MariNanari under the MIT license. In short, it is a bridge plugin that connects two MIT-licensed open-source security CLIs—VulnClaw and DeepSec—to DSH.

A few design facts are clarified first:

  1. The plugin itself does not bundle the CLI but calls VulnClaw/DeepSec as subprocesses; it does not contain their code.
  2. The bridge layer has zero third-party runtime dependencies, only invoking DSH official services (tools, subprocess, webServer, etc.).
  3. It does not modify any DSH official files; an uninstall is clean.

Core Features

Graphical Security Workbench

The plugin adds a “Security Workbench” tab in the DSH settings page, with an entry point for “⛨ Security Workbench” at the bottom of the sidebar. Opening it reveals a fullscreen panel. All controls have tooltips; hovering over buttons or input boxes will show functional descriptions.

VulnClaw: End-to-End Authorized Penetration

Covers information gathering, vulnerability scanning, exploitation, one-click full pipeline, and target-driven solving. All penetration actions are limited to authorized targets.

DeepSec Shield: Three-Layer Code Audit

  • L1 Heuristic, <50ms;
  • L2 AST, <2s;
  • L3 LLM semantic analysis, requiring the Provider / Base URL / Model Name / API Key to be filled in the configuration card, and connectivity verified via “Test Connection”.

Output formats support text / json / sarif / markdown. There is also a “One-click Audit” feature: input a directory to audit, with risk alerts displayed in real-time.

DeepSec Spear: End-to-End Authorized Penetration

The process is recon → explore → fact → reflect → report → PoC. The target must be within the scope whitelist; targets not on the whitelist will be rejected directly.

Plugin Security Review

Newly loaded third-party plugins will automatically execute a Shield scan (deduplicated within 24 hours, official and built-in plugins are automatically skipped), but manual specification of the review is also supported.

18 dsh Tools and Web API

Tools are grouped into three categories by prefix:

  • Status and Install: sec_tools_status (checks if the two CLIs are available, returns the located executable file path and version), sec_tools_install (one-click install);
  • VulnClaw: vulnclaw_recon / vulnclaw_scan / vulnclaw_exploit (information gathering / vulnerability scanning / exploitation), vulnclaw_run / vulnclaw_solve (one-click full pipeline / target-driven solving), vulnclaw_report / vulnclaw_config (session report / configuration management);
  • DeepSec: deepsec_shield_scan (Shield full-layer audit), deepsec_shield_agent_audit / deepsec_shield_supply_chain (agent configuration audit / supply chain and hallucination package check), deepsec_spear_recon / deepsec_spear_run (recon / end-to-end authorized penetration), deepsec_scope / deepsec_config / deepsec_report (authorized scope / configuration / report), deepsec_audit_all (one-click audit: Shield full-layer scan → supply chain check → agent configuration audit, merging outputs).

The Workbench UI uses Web routes under /vulnsec/api: GET /vulnsec/api/status to check CLI status, POST /vulnsec/api/run to execute any tool, POST /vulnsec/api/scope to manage the scope whitelist, POST /vulnsec/api/config and POST /vulnsec/api/llm:test for LLM configuration and connectivity testing, GET/POST /vulnsec/api/audits to view or manually trigger plugin reviews, and POST /vulnsec/api/install to trigger one-click installation.

Output Sanitization and Truncation

Tool outputs are automatically sanitized (API keys in the form sk-…, secret values, private key blocks) and truncated to 120KB to prevent large response pollution of the context.

Installation and Usage

First, confirm the environment: any dsh 0.1.x; Node.js ≥ 22.13; pnpm 9+ (or corepack); Python 3.10+ is optional, only needed for one-click CLI installation; network is optional, only needed when pulling source code from a CDN.

It is recommended to download the installation package dsh-vulnsec-bridge-<version>.tgz from Releases; no compilation is required. Perform unzip and rename:

  1. After unzipping, you get a package/ directory; rename it to dsh-vulnsec-bridge (this step cannot be skipped);
  2. Place the directory in a path without spaces (e.g., C:\dsh-plugins\dsh-vulnsec-bridge), then execute the installation command:
dsh plugin --profile web add C:\dsh-plugins\dsh-vulnsec-bridge

This command adds the plugin to the bundles assembly layer of the profile. Note that the path cannot contain spaces: on Windows, dsh forwards pnpm via the shell, and paths with spaces will be split into multiple arguments, causing installation failure. If the original path contains spaces, copy the plugin directory to a path without spaces first and then execute.

  1. Restart DSH, then go to Settings → “Security Workbench” to use it.

The plugin itself does not include the CLI; after installation, you still need to install VulnClaw/DeepSec. Choose one of the two methods: click “⚡ One-click Install CLI” in the status bar of the Workbench, or execute the command line:

node --use-system-ca scripts/install-cli.js

The installation script will automatically detect Python → create a standalone venv → pull the source code of the two CLIs from the CDN → pip install and verify. It is idempotent and can be run repeatedly.

The CLI lookup order is: Environment variables VULNSEC_VULNCLAW / VULNSEC_DEEPSEC (absolute path to executable) → Default venv <plugin directory>/../sec-tools-venv (overridable via VULNSEC_VENV) → PATH fallback.

Typical Usage

After completing the above steps, restart DSH and open the “Security Workbench”:

  1. First check the status bar: when it shows vulnclaw ✗ / deepsec ✗, click “⚡ One-click Install CLI”; when the status turns green, it is ready for use;
  2. Code Audit: Enter the project path in the Shield card → Select all for the detection layer → Click “One-click Audit”;
  3. Authorized Penetration: First add the target to the whitelist in the Scope card → Enter target + authorization file + mode in the Spear card → Execute;
  4. L3 LLM Semantic Analysis: Fill in Provider / Base URL / Model Name / API Key in the Configuration card → Click “Test Connection”.

Results are displayed in real-time in the bottom log area, already sanitized and truncated.

Upgrade Compatibility and Self-Check

DSH versions iterate quickly. The plugin is designed with “defensive adaptation” in mind, so it will not crash after upgrading DSH due to API changes:

  • apply never throws: an overall try/catch is used during initialization. If a service is missing or its shape changes, it only degrades (logging), it will not cause DSH startup to fail;
  • Capability detection: Safely obtains tools / subprocess / webServer; automatically degrades if missing, and returns clear error messages instead of crashing if a tool is unavailable;
  • Individual error tolerance: If a single tool registration fails, that tool is skipped, and the registration of other tools and the Web API is not affected.

After upgrading DSH, it is recommended to run the self-test script provided with the package:

node scripts/selftest.mjs

It mocks three scenarios: complete services, no services, and partial services, verifying that apply does not throw. If a new version is indeed incompatible, the plugin can be removed at any time:

dsh plugin --profile web remove dsh-vulnsec-bridge

The plugin does not modify any DSH official files; an uninstall is clean.

Use Cases and Considerations

Suitable for two types of people: those who want to integrate code auditing into the dsh workflow (input project directory for three-layer audit or one-click audit); and users performing penetration testing under authorization, where VulnClaw full pipeline and Spear end-to-end penetration are provided as dsh tools.

Pay attention to a few points before use:

  1. All penetration features are limited to authorized targets. The plugin runs with the permissions of the current dsh process and can access resources accessible by that process. Before installing, it is recommended to check the repository source code and license (MIT; both called CLIs are also MIT open-source projects);
  2. One-click CLI installation requires a network (pulling source code from CDN); other functions do not depend on the network;
  3. The installation path should not contain spaces; otherwise, dsh will fail to split parameters when forwarding pnpm.

Conclusion

dsh-vulnsec-bridge focuses on a specific task: turning the two security CLIs, VulnClaw and DeepSec, into 18 dsh tools that the model can call directly, paired with a graphical “Security Workbench”. Details like output sanitization, scope whitelisting, and upgrade self-checks are all handled at the plugin layer. If your dsh environment requires security auditing or authorized penetration capabilities, give it a try.

Code and Releases are on GitHub: https://github.com/MariNanari/dsh-vulnsec-bridge . The plugin is also listed in a community-maintained plugin directory (independent site, no official affiliation with DeepSeek / Quantcube): https://www.skillhub.cn/plugins/MariNanari/dsh-vulnsec-bridge (The directory page URL is from the listing info; please refer to the actual page on the site).